SCAM PREVENTION
QR Code Scams: Check Before You Scan
A QR code hides its destination. Use this quick routine before opening, paying or signing in.
Why QR codes need a second look
A QR code is only a shortcut to data, often a web address. It can lead to a genuine menu or payment page, but it can also open a copied login form, a payment request or a harmful download. The printed squares do not reveal the destination by themselves. Treat an unfamiliar QR code the same way you would treat an unexpected link in a text message.
Check the physical code
Look for a sticker placed over another code, signs of tampering or a code positioned where the organization cannot control it. This matters on parking meters, restaurant tables, parcel notices and public posters. When payment is involved, use the official app or type the provider’s known website instead. Ask an employee when the code’s placement or branding looks unusual.
Preview the destination
Most phone cameras show the web address before opening it. Read the domain carefully, not just the page title. Watch for misspellings, unexpected shortened links and domains that add a familiar company name as a subdomain. HTTPS protects the connection but does not prove that the owner is trustworthy. If the preview is unclear, close it and navigate through a known channel.
Stop when urgency appears
Do not continue when a scanned page claims you must immediately pay a fine, unlock an account or verify a delivery. Never enter a password, card number or OTP simply because the page says time is running out. Open the organization’s official app independently and check whether the same alert appears there. A genuine issue can normally be confirmed without the QR code.
If you already scanned it
Scanning alone is different from entering information or installing an app. Close the page first. If you entered a password, change it from the genuine service, sign out unfamiliar sessions and enable stronger authentication. If you submitted payment details, contact the card issuer using the number on the card. Remove any app installed through the page and run the phone’s built-in security checks.